/*
 * Copyright 2014 The Netty Project
 *
 * The Netty Project licenses this file to you under the Apache License,
 * version 2.0 (the "License"); you may not use this file except in compliance
 * with the License. You may obtain a copy of the License at:
 *
 *   http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
 * License for the specific language governing permissions and limitations
 * under the License.
 */
package io.netty.handler.ssl;

import io.netty.internal.tcnative.SSL;

import java.io.File;
import java.security.PrivateKey;
import java.security.cert.X509Certificate;

import javax.net.ssl.KeyManagerFactory;
import javax.net.ssl.SSLException;
import javax.net.ssl.TrustManager;
import javax.net.ssl.TrustManagerFactory;

import static io.netty.handler.ssl.ReferenceCountedOpenSslClientContext.newSessionContext;

/**
 * A client-side {@link SslContext} which uses OpenSSL's SSL/TLS implementation.
 * <p>
 * This class will use a finalizer to ensure native resources are automatically
 * cleaned up. To avoid finalizers and manually release the native memory see
 * {@link ReferenceCountedOpenSslClientContext}.
 */
public final class OpenSslClientContext extends OpenSslContext
{
    private final OpenSslSessionContext sessionContext;

    /**
     * Creates a new instance.
     * @deprecated use {@link SslContextBuilder}
     */
    @Deprecated
    public OpenSslClientContext() throws SSLException
    {
        this((File) null, null, null, null, null, null, null,
                IdentityCipherSuiteFilter.INSTANCE, null, 0, 0);
    }

    /**
     * Creates a new instance.
     *
     * @param certChainFile an X.509 certificate chain file in PEM format.
     *        {@code null} to use the system default
     * @deprecated use {@link SslContextBuilder}
     */
    @Deprecated
    public OpenSslClientContext(File certChainFile) throws SSLException
    {
        this(certChainFile, null);
    }

    /**
     * Creates a new instance.
     *
     * @param trustManagerFactory the {@link TrustManagerFactory} that provides
     *        the {@link TrustManager}s that verifies the certificates sent from
     *        servers. {@code null} to use the default.
     * @deprecated use {@link SslContextBuilder}
     */
    @Deprecated
    public OpenSslClientContext(TrustManagerFactory trustManagerFactory)
            throws SSLException
    {
        this(null, trustManagerFactory);
    }

    /**
     * Creates a new instance.
     *
     * @param certChainFile an X.509 certificate chain file in PEM format.
     *        {@code null} to use the system default
     * @param trustManagerFactory the {@link TrustManagerFactory} that provides
     *        the {@link TrustManager}s that verifies the certificates sent from
     *        servers. {@code null} to use the default.
     * @deprecated use {@link SslContextBuilder}
     */
    @Deprecated
    public OpenSslClientContext(File certChainFile,
            TrustManagerFactory trustManagerFactory) throws SSLException
    {
        this(certChainFile, trustManagerFactory, null, null, null, null, null,
                IdentityCipherSuiteFilter.INSTANCE, null, 0, 0);
    }

    /**
     * Creates a new instance.
     *
     * @param certChainFile an X.509 certificate chain file in PEM format
     * @param trustManagerFactory the {@link TrustManagerFactory} that provides
     *        the {@link TrustManager}s that verifies the certificates sent from
     *        servers. {@code null} to use the default..
     * @param ciphers the cipher suites to enable, in the order of preference.
     *        {@code null} to use the default cipher suites.
     * @param apn Provides a means to configure parameters related to
     *        application protocol negotiation.
     * @param sessionCacheSize the size of the cache used for storing SSL
     *        session objects. {@code 0} to use the default value.
     * @param sessionTimeout the timeout for the cached SSL session objects, in
     *        seconds. {@code 0} to use the default value.
     * @deprecated use {@link SslContextBuilder}
     */
    @Deprecated
    public OpenSslClientContext(File certChainFile,
            TrustManagerFactory trustManagerFactory, Iterable<String> ciphers,
            ApplicationProtocolConfig apn, long sessionCacheSize,
            long sessionTimeout) throws SSLException
    {
        this(certChainFile, trustManagerFactory, null, null, null, null,
                ciphers, IdentityCipherSuiteFilter.INSTANCE, apn,
                sessionCacheSize, sessionTimeout);
    }

    /**
     * Creates a new instance.
     *
     * @param certChainFile an X.509 certificate chain file in PEM format
     * @param trustManagerFactory the {@link TrustManagerFactory} that provides
     *        the {@link TrustManager}s that verifies the certificates sent from
     *        servers. {@code null} to use the default..
     * @param ciphers the cipher suites to enable, in the order of preference.
     *        {@code null} to use the default cipher suites.
     * @param cipherFilter a filter to apply over the supplied list of ciphers
     * @param apn Provides a means to configure parameters related to
     *        application protocol negotiation.
     * @param sessionCacheSize the size of the cache used for storing SSL
     *        session objects. {@code 0} to use the default value.
     * @param sessionTimeout the timeout for the cached SSL session objects, in
     *        seconds. {@code 0} to use the default value.
     * @deprecated use {@link SslContextBuilder}
     */
    @Deprecated
    public OpenSslClientContext(File certChainFile,
            TrustManagerFactory trustManagerFactory, Iterable<String> ciphers,
            CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apn,
            long sessionCacheSize, long sessionTimeout) throws SSLException
    {
        this(certChainFile, trustManagerFactory, null, null, null, null,
                ciphers, cipherFilter, apn, sessionCacheSize, sessionTimeout);
    }

    /**
     * Creates a new instance.
     * @param trustCertCollectionFile an X.509 certificate collection file in
     *        PEM format. {@code null} to use the system default
     * @param trustManagerFactory the {@link TrustManagerFactory} that provides
     *        the {@link TrustManager}s that verifies the certificates sent from
     *        servers. {@code null} to use the default or the results of parsing
     *        {@code trustCertCollectionFile}
     * @param keyCertChainFile an X.509 certificate chain file in PEM format.
     *        This provides the public key for mutual authentication.
     *        {@code null} to use the system default
     * @param keyFile a PKCS#8 private key file in PEM format. This provides the
     *        private key for mutual authentication. {@code null} for no mutual
     *        authentication.
     * @param keyPassword the password of the {@code keyFile}. {@code null} if
     *        it's not password-protected. Ignored if {@code keyFile} is
     *        {@code null}.
     * @param keyManagerFactory the {@link KeyManagerFactory} that provides the
     *        {@link javax.net.ssl.KeyManager}s that is used to encrypt data
     *        being sent to servers. {@code null} to use the default or the
     *        results of parsing {@code keyCertChainFile} and {@code keyFile}.
     * @param ciphers the cipher suites to enable, in the order of preference.
     *        {@code null} to use the default cipher suites.
     * @param cipherFilter a filter to apply over the supplied list of ciphers
     * @param apn Application Protocol Negotiator object.
     * @param sessionCacheSize the size of the cache used for storing SSL
     *        session objects. {@code 0} to use the default value.
     * @param sessionTimeout the timeout for the cached SSL session objects, in
     *        seconds. {@code 0} to use the default value.
     * @deprecated use {@link SslContextBuilder}
     */
    @Deprecated
    public OpenSslClientContext(File trustCertCollectionFile,
            TrustManagerFactory trustManagerFactory, File keyCertChainFile,
            File keyFile, String keyPassword,
            KeyManagerFactory keyManagerFactory, Iterable<String> ciphers,
            CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apn,
            long sessionCacheSize, long sessionTimeout) throws SSLException
    {
        this(toX509CertificatesInternal(trustCertCollectionFile),
                trustManagerFactory,
                toX509CertificatesInternal(keyCertChainFile),
                toPrivateKeyInternal(keyFile, keyPassword), keyPassword,
                keyManagerFactory, ciphers, cipherFilter, apn, sessionCacheSize,
                sessionTimeout);
    }

    OpenSslClientContext(X509Certificate[] trustCertCollection,
            TrustManagerFactory trustManagerFactory,
            X509Certificate[] keyCertChain, PrivateKey key, String keyPassword,
            KeyManagerFactory keyManagerFactory, Iterable<String> ciphers,
            CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apn,
            long sessionCacheSize, long sessionTimeout) throws SSLException
    {
        super(ciphers, cipherFilter, apn, sessionCacheSize, sessionTimeout,
                SSL.SSL_MODE_CLIENT, keyCertChain, ClientAuth.NONE, false);
        boolean success = false;
        try
        {
            sessionContext = newSessionContext(this, ctx, engineMap,
                    trustCertCollection, trustManagerFactory, keyCertChain, key,
                    keyPassword, keyManagerFactory);
            success = true;
        }
        finally
        {
            if (!success)
            {
                release();
            }
        }
    }

    @Override
    public OpenSslSessionContext sessionContext()
    {
        return sessionContext;
    }

    @Override
    OpenSslKeyMaterialManager keyMaterialManager()
    {
        return null;
    }
}
